Uds Identity Config
Approved changes feed: RSS · Atom
cpe:2.3:a:defenseunicorns:uds-identity-config:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Defenseunicorns (46a0b017-337d-5cb3-9979-b41f85cd31d2) |
|---|---|
| Product | Uds Identity Config (e5ffeb5c-d833-5988-a9df-ea1f6446bc2e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-46389 |
vulnerable | 2026-06-08 08:05:12.062099 |
UDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator`
CRITICAL (10)
UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a `client_id` using this authenticator can authenticate as that client with any `client_secret` value and obtain OAuth2 tokens scoped to the client's service account. In the case of the `uds-operator` client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.
Published: 2026-06-05T18:10:47.173Z
Updated: 2026-06-05T19:40:55.970Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.